To: 


Of: 


ICO. 


Information Commissioner's Office 


DATA PROTECTION ACT 1998 


SUPERVISORY POWERS OF THE INFORMATION COMMISSIONER 


MONETARY PENALTY NOTICE 


Valca Vehicle and Life Cover Agency Limited 


281 Palatine Road, Manchester, England M22 4ET 


The Information Commissioner (“Commissioner”) has decided to issue 
Valca Vehicle and Life Cover Agency Limited (“Valca”) with a monetary 
penalty under section 55A of the Data Protection Act 1998 (“DPA”). The 
penalty is in relation to a serious contravention of Regulations 22 and 
23 of the Privacy and Electronic Communications (EC Directive) 
Regulations 2003 (“PECR”). 


This notice explains the Commissioner’s decision. 


Legal framework 


Valca, whose registered office is given above (Companies House 
Registration Number: 11013461) is the organisation stated in this 
notice to have transmitted unsolicited communications by means of 
electronic mail to individual subscribers for the purposes of direct 


marketing contrary to regulation 22 of PECR. 


Regulation 22 of PECR states: 
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“(1) This regulation applies to the transmission of unsolicited 


communications by means of electronic mail to individual 


subscribers. 


(2) Except in the circumstances referred to in paragraph (3), a person 
shall neither transmit, nor instigate the transmission of, unsolicited 
communications for the purposes of direct marketing by means of 
electronic mail unless the recipient of the electronic mail has 
previously notified the sender that he consents for the time being 
to such communications being sent by, or at the instigation of, the 


sender. 


(3) A person may send or instigate the sending of electronic mail for 


the purposes of direct marketing where— 


(a) that person has obtained the contact details of the recipient 
of that electronic mail in the course of the sale or 
negotiations for the sale of a product or service to that 


recipient; 


(b) the direct marketing is in respect of that person’s similar 


products and services only; and 


(c) the recipient has been given a simple means of refusing 
(free of charge except for the costs of the transmission of 
the refusal) the use of his contact details for the purposes 
of such direct marketing, at the time that the details were 
initially collected, and, where he did not initially refuse the 
use of the details, at the time of each subsequent 


communication. 


(4) A subscriber shall not permit his line to be used in contravention of 


paragraph (2).” 


5. 
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Regulation 23 of PECR states that “A person shall neither transmit, nor 


instigate the transmission of, a communication for the purposes of 


direct marketing by means of electronic mail - 


(a) where the identity of the person on whose behalf the 
communication has been sent has been disguised or 


concealed; 


(b) where a valid address to which the recipient of the 
communication may send a request that such 


communications cease has not been provided 


(c) where that electronic mail would contravene regulation 7 of 
the Electronic Commerce (EC Directive) Regulations 2002; 


or 


(d) where that electronic mail encourages recipients to visit 


websites which contravene that regulation.” 


Section 122(5) of the DPA 2018 defines direct marketing as “the 
communication (by whatever means) of advertising material which is 
directed to particular individuals”. This definition also applies for the 
purposes of PECR (see regulation 2(2) PECR; and Schedule 19, 
paragraph 430 and 432(6) DPA18). 


Consent is defined in Article 4(11) the General Data Protection 
Regulation 2016/679 as “any freely given, specific, informed and 
unambiguous indication of the data subject’s wishes by which he or 
she, by a statement or by a clear affirmative action, signifies 


agreement to the processing of personal data relating to him or her. 


“Individual” is defined in regulation 2(1) of PECR as “a living individual 


and includes an unincorporated body of such individuals”. 
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9. A “subscriber” is defined in regulation 2(1) of PECR as “a person who is 


a party to a contract with a provider of public electronic 


communications services for the supply of such services”. 


10. “Electronic mail” is defined in regulation 2(1) of PECR as “any text, 
voice, sound or image message sent over a public electronic 
communications network which can be stored in the network or in the 
recipient’s terminal equipment until it is collected by the recipient and 


includes messages sent using a short message service”. 


11. Section 55A of the DPA (as amended by the Privacy and Electronic 
Communications (EC Directive)(Amendment) Regulations 2011 and the 
Privacy and Electronic Communications (Amendment) Regulations 
2015) states: 


“(1) The Commissioner may serve a person with a monetary penalty if 


the Commissioner is satisfied that - 


(a) there has been a serious contravention of the requirements 
of the Privacy and Electronic Communications (EC 


Directive) Regulations 2003 by the person, 
(b) subsection (2) or (3) applies. 
(2) This subsection applies if the contravention was deliberate. 
(3) This subsection applies if the person - 


(a) knew or ought to have known that there was a risk that 


the contravention would occur, but 


(b) failed to take reasonable steps to prevent the 


contravention.” 
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The Commissioner has issued statutory guidance under section 55C (1) 

of the DPA about the issuing of monetary penalties that has been 

published on the ICO’s website. The Data Protection (Monetary 

Penalties) (Maximum Penalty and Notices) Regulations 2010 prescribe 


that the amount of any penalty determined by the Commissioner must 
not exceed £500,000. 


PECR implements European legislation (Directive 2002/58/EC) aimed at 
the protection of the individual’s fundamental right to privacy in the 
electronic communications sector. PECR was amended for the purpose 
of giving effect to Directive 2009/136/EC which amended and 
strengthened the 2002 provisions. The Commissioner approaches PECR 


so as to give effect to the Directives. 


The provisions of the DPA remain in force for the purposes of PECR 
notwithstanding the introduction of the Data Protection Act 2018 (see 
paragraph 58(1) of Part 9, Schedule 20 of that Act). 


Background to the case 


Phone users can report the receipt of unsolicited marketing text 
messages to the GSMA’s Spam Reporting Service by forwarding the 
message to 7726 (spelling out “SPAM”). The GSMA is an organisation 
that represents the interests of mobile operators worldwide. The 
Commissioner is provided with access to the data on complaints made 
to the 7726 service and this data is incorporated into a Monthly Threat 


Assessment (MTA) used to ascertain organisations in breach of PECR. 


Valca are a company specialising in lead generation for financial 


products. They currently operate as ‘Debtquity’ to generate leads for 
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Individual Voluntary Agreements (“IVA’s”) and other debt management 


products. 


Valca came to the attention of the Commissioner after an initial 22 
complaints were received via the 7726 complaints tool about 
unsolicited text messages between 15 June 2020 and 23 June 2020. 
These text messages contained, or contained slight variations of, the 


following text: 


“*firstname* Affected by Covid? Struggling with finances? lost job 
/furloughed? Were here to help! Gvnmnt backed support see if you 


qualify http://www.debtquity.org” 


It was noted that these texts did not offer individuals an ability to ‘opt- 


out’ of future unsolicited text messages. 


An initial investigation letter was sent to Valca on 24 June 2020, 
highlighting the Commissioner’s concerns with Valca’s PECR compliance 
and requesting information relating to the volumes of texts sent, the 
source of data used to send said texts, details of any due diligence 
undertaken, together with questions regarding the lack of an opt-out in 
the text messages for which there had been complaints. An appendix 


detailing the complaints received was also sent to Valca. 


The director of Valca provided a partial response on 24 June 2020 
stating that “all data we use is fully compliant and purchased from 
credible UK data suppliers that we carried out full due diligence against 
prior to point of supply, in relation to not listing an opt out on said SMS 
messages this is down to human error and has been amended now for 
future broadcasts, we are happy to send out an opt out message to the 
complaints made to date which is a total of 23 from a one of broadcast 


of 30.000 lines of opted in data. We only commenced the sms 
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campaign on the 15" June 2020 so we have nipped this in the bud 


extremely early” [sic]. 


The Commissioner, on 25 June 2020, advised Valca not to contact the 
complainants again, but to add them to a suppression list, and asked 
that Valca respond to all of the initial questions asked by the 


Commissioner in full. 


A further substantive response was provided by Valca on 7 July 2020. 
This response advised that two platforms were used to send Valca’s 


direct marketing messages: J, and GE with reports being 
provided to show the volumes of messages sent via those platforms. 


Valca confirmed that its data was purchased from a third party: m 
=a Limited (the “third-party data provider”), and that 
regarding its due diligence with the third-party data provider, it 
“matched our campaign and Company requirements against fully opted 
in data, due diligence wise we run various checks on any Company that 
we consider using from the ICO MOJ and other governing bodies to 
ensure that there are no outstanding concerns relating to them as a 
potential supplier, we also look at financials, recommendations from 
other Companies within this arena and finally check out any online 


listings for any bad press”. 


In terms of evidencing how consent is obtained by the third-party data 
provider for Valca to engage in direct marketing, Valca advised that it 
is “on privacy policy and other privacy policies allow for third party 


marketing also” [sic]. 


The Commissioner directed further enquiries to Valca on 8 July 2020, 
requesting information as to the data purchased, and the agreement 


with the third-party data provider. An updated complaints spreadsheet 
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was provided to Valca, showing that there had now been a total of 68 


complaints recognised in relation to its text messages. 


Valca provided a further response on 17 July 2020 stating that it had 
purchased 100,000 records from the third-party data provider which 
were “fully opted in for SMS”. Valca was unable to produce a contract 
as it had been a “trial order” but did produce an invoice between itself 
and its third-party data provider dated 16 March 2020 confirming the 
purchase of 100,000 leads, and payment for a ‘privacy policy edit’ to 
he Valca produced updated ‘outbound SMS’ reports for 


its ET ang ‘| platforms, although it noted that a 


had been used for just one day. Valca also produced a document as 
purported evidence of consent for the initial 22 complaints, with each 


of the 22 complainant’s data having been obtained through 


Po requires users to register with it to use its services 


and operates by offering ‘deals’. At the point of registration, users 
agree to a consent statement where they are able to select whether 
they wish to be contacted by email, SMS, post, and/or telephone, 
together with a further option to agree to being contacted by ‘the 
following partners’ using the agreed methods. The ‘Partners’ link takes 
users to a ‘brands page’ which lists 16 distinct companies, none of 
which are Valca. There appears to be no option for users to 


select/deselect partners. 


Upon viewing | Privacy Policy, users are told: 


“Once you register with the our website you consent to iii, 
its sponsor question clients and website sponsors being able to send 


you communications via the channel(s) you selected as part of the sign 
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up until such time as you exercise your right to opt-out of receiving 


such communications” 


The Privacy Policy proceeds to provide two further lists of companies: a 
‘marketing service providers’ list containing 7 distinct companies, and a 
list of ‘direct clients’ containing 443 distinct companies. The Privacy 
Policy’s ‘Data Collection Notice’ advises that Sel and its 
partners operate in over 40 areas, spanning a wide range of sectors 
including fashion, automotive, gambling, construction, legal services 
etc. The Commissioner noted that Valca were not visible at all as of 
checks carried out on the website’s privacy policy separately on 22 
June 2020 but were visible as one of the 443 ‘direct clients’ on 21 July 


2020. The precise date on which Valca became visible is not known. 


On 22 July 2020 the Commissioner served a third-party Information 
Notice ("3PIN”) on [iy iE BENIN to establish, inter 
alia, the number of connected messages sent by Valca between 1 June 
2020 and 20 July 2020. 


The response to the 3PIN advised that there had been 104,550 
messages sent by Valca between 15 June 2020 and 20 July 2020, of 


which 95,004 were delivered to a subscriber. 


The 3PIN also provided details of the content for each of the messages 
sent, of which a trend could be identified that none of the messages 
sent contained an opt-out link until 25 June 2020 - the first day 
following the Commissioner’s initial investigation letter. It can 
therefore be determined that between 15 June 2020 and 24 June 2020 
there were 24,995 text messages sent without an opt-out link, of which 
18,393 were delivered. 
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The Commissioner is aware, from information provided by Valca on 7 
July 2020, of a further 2,025 text messages being sent by Valca over 
the period of contravention using the Sj platform, although this 
platform was used for just one day, and the number of received 


messages is unknown and is unlikely to be obtainable. 


As of 20 July 2020, the Commissioner was able to identify a total of 
114 complaints concerning Valca’s unsolicited direct marketing text 


messages over the relevant period. 
An ‘end of investigation’ letter was sent to Valca on 21 July 2020. 


The Commissioner has since identified that between 21 July 2020 and 
13 November 2020 there were a further 165 complaints made about 


Valca via the 7726 service. 


The Commissioner has made the above findings of fact on the 


balance of probabilities. 

The Commissioner has considered whether those facts constitute 

a contravention of regulations 22 and 23 of PECR by Valca and, if so, 
whether the conditions of section 55A DPA are satisfied. 


The contravention 


The Commissioner finds that Valca contravened regulations 22 and 23 
of PECR. 


The Commissioner finds that the contravention was as follows: 


The Commissioner finds that between 15 June 2020 and 20 July 2020 


there were 95,004 unsolicited direct marketing text messages received 
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by subscribers. This resulted in a total of 114 complaints being 
received via the 7726 service. The Commissioner finds that Valca 


transmitted the direct marketing messages received, contrary to 
regulation 22 of PECR. 


The Commissioner is satisfied that the contravention could have been 
higher, with a total of 104,550 unsolicited text messages being sent 
over the relevant time using the EE platform, and a further 2,025 


being sent using en. 


Of the messages known to have been received, 18,393 (i.e., all of 
those received before 25 June 2020) did not contain an opt-out link, 


contrary to the requirements of regulation 23 PECR. 


Valca, as the sender of the direct marketing, is required to ensure that 
it is acting in compliance with the requirements of regulation 22 of 
PECR, and to ensure that valid consent to send those messages had 


been acquired. 


Valca relied on consent obtained by another organisation for its own 
purposes, i.e., ‘indirect consent’. The Commissioner’s direct marketing 
guidance says “organisations need to be aware that indirect consent 
will not be enough for texts, emails or automated calls. This is because 
the rules on electronic marketing are stricter, to reflect the more 


intrusive nature of electronic messages.” 


It goes on to say that indirect consent can be valid but only if it is clear 
and specific enough. Moreover, “the customer must have anticipated 
that their details would be passed to the organisation in question, and 
that they were consenting to messages from that organisation. This will 


depend on what exactly they were told when consent was obtained”. 
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Consent will not be “informed” if individuals do not understand what 

they are consenting to. Organisations should therefore always ensure 

that the language used is clear, easy to understand, and not hidden 

away in a privacy policy or small print. The Commissioner is concerned 

that at the point of consent being obtained, subscribers are asked to 

tick a box which gives a misleading impression that only a limited 

number of 16 organisations may contact them (duly named within the 

‘partners’ link on the registration page). However, it is only if 

subscribers drill down into the separate privacy policy that they are 

advised that any one of 450 companies may in fact contact them, none 


of which the subscriber has any ability to refuse contact from. 


It is the Commissioner’s position that consent will not be valid if 
individuals are asked to agree to receive marketing from “similar 
organisations”, “partners”, “selected third parties” or other similar 
generic description. Further, and relevantly, consent will not be valid 
where an individual is presented with a long, seemingly exhaustive list 
of general categories of organisations. The Commissioner finds that 
450 organisations, concerning 40 sectors, is far too exhaustive a list to 


enable individuals to give valid consent. 


During the course of the investigation, Valca provided an invoice dated 
16 March 2020 between it and its third-party data provider to 
demonstrate that it had paid to be added to the privacy policy for 
rss | the website from which its third-party data provider 
obtained data. The date on which Valca were added to the privacy 
policy is unclear, however the Commissioner has evidence that it was 
not listed as a ‘direct client’, or apparently at all on D, 
by 22 June 2020, by which point Valca had already sent 16,759 
unsolicited text messages using data obtained from that site. In any 


event, even after Valca had been added to the privacy policy, the 
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Commissioner has concerns that any consents relied on by Valca 


cannot be said to be valid. 


There is nothing immediately in the consent statement at registration 
that would inform an individual that by agreeing to the privacy policy 
and terms and conditions, they are in fact agreeing for their data to be 
passed to 450 companies spanning 40 various sectors. Whilst there is a 
third-party consent opt-in box, this only lists 16 companies at the point 
of consent and gives individuals no indication that for a more 
comprehensive list they will need to consult the privacy policy. This 


cannot constitute informed consent. 


The Commissioner is therefore satisfied from the evidence she has 
seen that Valca did not have the necessary valid consent to send the 
95,004 unsolicited direct marketing messages received by subscribers. 


This constitutes a contravention of regulation 22 PECR. 


The Commissioner is also concerned that 18,393 of those received 
messages (i.e., all of those received before the Commissioner’s initial 
investigation letter) did not contain an opt-out link. As such, the 
Commissioner is satisfied that the actions of Valca in respect of these 


18,393 messages have also contravened regulation 23 PECR. 


The Commissioner has gone on to consider whether the conditions 


under section 55A DPA are met. 
Seriousness of the contravention 


The Commissioner is satisfied that the contravention identified 

above was serious. This is because between 15 June 2020 and 20 July 

2020 a total of 95,004 connected unsolicited direct marketing 

messages were received by subscribers, resulting in 114 complaints. 
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Valca has failed to provide any evidence of valid consent for any of the 


95,004 unsolicited direct marketing messages received by subscribers. 


In addition, the Commissioner is concerned by the content of the 
unsolicited text messages which reference the Covid-19 pandemic and 
appeal to individuals whose finances have been adversely affected. 
This, in the Commissioner's view, is a clear attempt to capitalise on, 


and profiteer from, the national health crisis. 


The Commissioner is therefore satisfied that condition (a) from 
section 55A(1) DPA is met. 


Deliberate or negligent contraventions 


The Commissioner has considered whether the contravention identified 


above was deliberate. 


The Commissioner considers that Valca deliberately set out to 
contravene PECR in this instance. The data relied on by Valca was not 
validly opted-in, and beyond paying a small sum for its inclusion on a 
privacy policy there is no indication that they sought to undertake any 
additional steps to ensure protection of individuals’ privacy rights, i.e., 
by observing the ‘customer journey’; doing so would likely have raised 
concerns with Valca regarding its reliance on the data being obtained. 
It is also concerning that Valca continued to send its unsolicited direct 
marketing text messages (albeit with an opt-out link) even following 
the Commissioner’s initial investigation correspondence which 


highlighted real concerns with the organisation’s compliance with PECR. 
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Further, and in any event, the Commissioner has gone on to consider 


whether the contravention identified above was negligent. This 


consideration comprises two elements: 


Firstly, she has considered whether Valca knew or ought reasonably to 
have known that there was a risk that these contraventions would 
occur. She is satisfied that this condition is met, not least since the 
issue of unsolicited text messages have been widely publicised by the 


media as being a problem. 


The Commissioner has published detailed guidance for those carrying 
out direct marketing explaining their legal obligations under PECR. 
This guidance gives clear advice regarding the requirements of consent 
for direct marketing and explains the circumstances under which 
organisations are able to carry out marketing over the phone, by text, 
by email, by post, or by fax. In particular it states that organisations 
can generally only send, or instigate, marketing messages to 
individuals if that person has specifically consented to receiving them. 
The guidance is also clear about the significant risks of relying on 


indirect consent, as Valca did in this instance. 


The Commissioner also notes that the company’s sole director, in a 
self-written biography on f6s.com, describes himself as a ‘serial 


entrepreneur with vast experience in sales and marketing’. 


It is therefore reasonable to suppose that Valca should have been 


aware of its responsibilities in this area. 


Secondly, the Commissioner has gone on to consider whether Valca 
failed to take reasonable steps to prevent the contraventions. Again, 


she is satisfied that this condition is met. 
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Valca used a bought-in list of data and relied on indirect consent for its 
unsolicited direct marketing messages. It claimed during the 
investigation that it had carried out “full due diligence”, however the 
Commissioner has seen little evidence of this in ensuring the veracity 
of the data being purchased aside from the production of an invoice to 
show that Valca were to be added to the privacy policy of 


Pe © an unknown date (which was, in any event, 


evidently not before 22 June 2020). 


Whilst Valca advised in the course of the investigation that “due 
diligence wise we run various checks on any Company that we consider 
using from the ICO MOJ and other governing bodies to ensure that 
there are no outstanding concerns relating to them as a potential 
supplier, we also look at financials, recommendations from other 
Companies within this arena and finally check out any online listings for 
any bad press” [sic], such checks do nothing to ensure that the data 


being obtained by Valca is compliant for its own marketing purposes. 


Such reasonable steps which the Commissioner might expect in these 
circumstances could have included ensuring a comprehensive contract 
was in place with the third-party data provider for the provision of the 
data to be relied upon, to ensure its reliability and validity. It would 
also have been reasonable for Valca to carry out its own checks as to 
how consent was being obtained via the Po site, 
notwithstanding any assurances by its third-party data provider - such 
checks would have alerted Valca to the inadequacy of the consents 
being obtained via this site for the purposes of third-party direct 
marketing. In short, simple reliance on assurances of indirect consent 


alone without undertaking proper due diligence is not acceptable. 


In the circumstances, the Commissioner is satisfied that Valca failed to 


take reasonable steps to prevent the contraventions. 
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The Commissioner is therefore satisfied that condition (b) from section 
55A (1) DPA is met. 


The Commissioner’s decision to issue a monetar enalt 


The Commissioner has also taken into account the following 


aggravating features of this case: 


Valca failed to include an opt-out in its unsolicited direct marketing 
messages up until the Commissioner’s initial investigation letter, in 


direct contravention of regulation 23 PECR; 


Thereafter, despite being under investigation by the Commissioner 
where concerns were raised regarding its PECR compliance, and where 
it was notified that a number of complaints had already been received, 
Valca continued to send unsolicited messages to its data set during the 


period of contravention; 


For the reasons explained above, the Commissioner is satisfied that the 
conditions from section 55A (1) DPA have been met in this case. She is 
also satisfied that the procedural rights under section 55B have been 


complied with. 


The latter has included the issuing of a Notice of Intent, in which the 
Commissioner set out her preliminary thinking. In reaching her final 
view, the Commissioner has taken into account the representations 


made by Valca on this matter. 


The Commissioner is accordingly entitled to issue a monetary penalty 


in this case. 
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The Commissioner has considered whether, in the circumstances, she 


should exercise her discretion so as to issue a monetary penalty. 


The Commissioner has considered the financial representations made, 
and the likely impact of a monetary penalty on Valca. She has decided 
on the information that is available to her, that a monetary penalty in 
the figure proposed remains an appropriate and proportionate response 


to the contravention. 


The Commissioner’s underlying objective in imposing a monetary 
penalty notice is to promote compliance with PECR. The sending of 
unsolicited marketing text messages is a matter of significant public 
concern. A monetary penalty in this case should act as a general 
encouragement towards compliance with the law, or at least as a 
deterrent against non-compliance, on the part of all persons running 
businesses currently engaging in these practices. The issuing of a 
monetary penalty will reinforce the need for businesses to ensure that 
they are only messaging those who specifically consent to receive 
marketing. 


For these reasons, the Commissioner has decided to issue a monetary 


penalty in this case. 


The amount of the penalty 


Taking into account all of the above, the Commissioner has decided 
that a penalty in the sum of £80,000 (eighty thousand pounds) is 
reasonable and proportionate given the particular facts of the case and 


the underlying objective in imposing the penalty. 
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Conclusion 


The monetary penalty must be paid to the Commissioner’s office by 
BACS transfer or cheque by 23 March 2021 at the latest. The 
monetary penalty is not kept by the Commissioner but will be paid into 
the Consolidated Fund which is the Government’s general bank account 
at the Bank of England. 


If the Commissioner receives full payment of the monetary penalty by 
22 March 2021 the Commissioner will reduce the monetary penalty 
by 20% to £64,000 (sixty-four thousand pounds). However, you 
should be aware that the early payment discount is not available if you 


decide to exercise your right of appeal. 


There is a right of appeal to the First-tier Tribunal (Information Rights) 


against: 


(a) the imposition of the monetary penalty 
and/or; 
(b) the amount of the penalty specified in the monetary penalty 


notice. 


Any notice of appeal should be received by the Tribunal within 28 days 


of the date of this monetary penalty notice. 
Information about appeals is set out in Annex 1. 


The Commissioner will not take action to enforce a monetary penalty 


unless: 
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e the period specified within the notice within which a monetary 


penalty must be paid has expired and all or any of the monetary 


penalty has not been paid; 


e all relevant appeals against the monetary penalty notice and any 


variation of it have either been decided or withdrawn; and 


e the period for appealing against the monetary penalty and any 


variation of it has expired. 


86. In England, Wales and Northern Ireland, the monetary penalty is 
recoverable by Order of the County Court or the High Court. In 
Scotland, the monetary penalty can be enforced in the same manner as 
an extract registered decree arbitral bearing a warrant for execution 


issued by the sheriff court of any sheriffdom in Scotland. 


Dated the 18t day of February 2021 


Andy Curry 

Head of Investigations 
Information Commissioner’s Office 
Wycliffe House 

Water Lane 

Wilmslow 

Cheshire 

SK9 5AF 
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ANNEX 1 
SECTION 55 A-E OF THE DATA PROTECTION ACT 1998 
RIGHTS OF APPEAL AGAINST DECISIONS OF THE COMMISSIONER 


lg Section 55B(5) of the Data Protection Act 1998 gives any person 
upon whom a monetary penalty notice has been served a right of 
appeal to the First-tier Tribunal (Information Rights) (the ‘Tribunal’) 


against the notice. 
2. If you decide to appeal and if the Tribunal considers:- 


a) that the notice against which the appeal is brought is not in 


accordance with the law; or 


b) to the extent that the notice involved an exercise of 
discretion by the Commissioner, that she ought to have exercised 


her discretion differently, 


the Tribunal will allow the appeal or substitute such other decision as 
could have been made by the Commissioner. In any other case the 


Tribunal will dismiss the appeal. 


Bs You may bring an appeal by serving a notice of appeal on the 


Tribunal at the following address: 


General Regulatory Chamber 
HM Courts & Tribunals Service 
PO Box 9300 


Leicester 
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LE1 8DJ 


Telephone: 0300 123 4504 


Email: grc@justice.gov.uk 


a) The notice of appeal should be sent so it is received by the 


Tribunal within 28 days of the date of the notice. 

b) If your notice of appeal is late the Tribunal will not admit it 
unless the Tribunal has extended the time for complying with this 
rule. 


The notice of appeal should state:- 


a) your name and address/name and address of your 


representative (if any); 


b) an address where documents may be sent or delivered to 


you; 

c) the name and address of the Information Commissioner; 
d) details of the decision to which the proceedings relate; 
e) the result that you are seeking; 

f) the grounds on which you rely; 


g) you must provide with the notice of appeal a copy of the 


monetary penalty notice or variation notice; 
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h) if you have exceeded the time limit mentioned above the 
notice of appeal must include a request for an extension of time 


and the reason why the notice of appeal was not provided in 


time. 


5; Before deciding whether or not to appeal you may wish to consult 
your solicitor or another adviser. At the hearing of an appeal a party 
may conduct his case himself or may be represented by any person 


whom he may appoint for that purpose. 


6. The statutory provisions concerning appeals to the First-tier 
Tribunal (Information Rights) are contained in section 55B(5) of, and 
Schedule 6 to, the Data Protection Act 1998, and Tribunal Procedure 
(First-tier Tribunal) (General Regulatory Chamber) Rules 2009 
(Statutory Instrument 2009 No. 1976 (L.20)). 
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